Patient Rights Under HIPAA Flashcards

A patient submits a written request to a covered entity to correct what they believe is a factual error in their medical record. Under the HIPAA Privacy Rule, what is the maximum time frame the entity has to respond to the patient's request for an amendment?

Answer: 60 days, with the option for one 30-day extension if the patient is notified in writing.

The HIPAA Privacy Rule at 45 C.F.R. § 164.526 requires a covered entity to act on a request for amendment no later than 60 days after receipt. The entity can extend this timeframe by an additional 30 days if it provides the individual with a written notice explaining the reason for the delay and the date by which it will complete its action.

A patient requests an accounting of disclosures of their Protected Health Information (PHI) from a hospital. Which of the following disclosures must be EXCLUDED from this accounting report?

Answer: A disclosure made to the patient's health plan for payment purposes.

The HIPAA Privacy Rule specifically exempts disclosures made for Treatment, Payment, and healthcare Operations (TPO) from the accounting of disclosures requirement. Disclosures for public health activities, in response to court orders, or for health oversight are not part of TPO and must be included in an accounting if requested.

A patient pays for a cosmetic procedure entirely out-of-pocket and asks the clinic not to share any information about this service with their health insurance plan. Under HIPAA, how must the clinic respond?

Answer: The clinic must agree to the request to restrict disclosure to the health plan.

The HIPAA Privacy Rule requires a covered entity to agree to a request to restrict disclosure of PHI to a health plan if the disclosure is for payment or health care operations and the PHI pertains solely to a service for which the individual has paid the covered entity in full out-of-pocket. In this scenario, the provider's compliance is mandatory, not optional.

Which of the following best describes a patient's right to request confidential communications from a healthcare provider under HIPAA?

Answer: The provider must accommodate reasonable requests to communicate via alternative means or at alternative locations.

Under 45 CFR § 164.522(b), a healthcare provider must permit individuals to request and must accommodate *reasonable* requests to receive communications of PHI by alternative means (e.g., cell phone vs. home phone) or at alternative locations (e.g., P.O. Box vs. home address). The provider cannot require the patient to explain the reason for the request.

A health care provider with a direct treatment relationship is giving a new patient their Notice of Privacy Practices (NPP) for the first time. According to HIPAA, when must this occur?

Answer: No later than the date of the first service delivery.

The HIPAA Privacy Rule requires that a covered health care provider with a direct treatment relationship with an individual must provide the Notice of Privacy Practices (NPP) no later than the date of the first service delivery. The requirement for health plans to notify members every three years is a different standard.

A patient requests an electronic copy of their medical records, which the provider maintains electronically. The patient specifies that the records should be in a PDF format. How must the provider respond under the HIPAA Right of Access?

Answer: The provider must supply the records in the requested PDF format if it is readily producible.

Under the HIPAA Right of Access, if an individual requests an electronic copy of PHI that a covered entity maintains electronically, the entity must provide access in the electronic form and format requested, if it is 'readily producible' in that format. If it is not readily producible in that format, the entity must offer other readable electronic formats.